ChatGPT Link Flaw Spawns Rogue AI Agent: AgentForger

Researchers at Zenity Labs found a way to turn a single ChatGPT link into an unattended agent that checked in with an attacker every five minutes, waiting for new instructions. The flaw sat inside OpenAI's Workspace Agents feature, and Zenity has given it a name: AgentForger. The mechanics are simple enough to explain in a sentence and troubling enough to warrant OpenAI fixing it within four days of disclosure.

A manipulated URL, once clicked, could spin up an autonomous agent running under the victim's own account, inheriting whatever app permissions that account already had. No malware, no separate login, no obvious red flag for a security team to catch. The agent just started acting, using the access already granted to a real employee.

Zenity frames this as a descendant of cross-site request forgery, the decades-old trick where a stray click triggers an action a user never authorized. AgentForger takes that idea and hands it a persistent, semi-autonomous foothold instead of a one-off command. That distinction, between a single forged request and a standing agent that keeps taking orders, is what Zenity argues current security tooling isn't built to catch.